Linux Process Creating esxcli System Permission Set Admin for an Account
Alerts when esxcli is run to set Admin permissions via the system/permission set flags.
- Product
- linux
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-09-04
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches process executions of the esxcli binary on Linux where the command line includes the system context and performs a permission set action for an Admin role on an account. Assigning administrative permissions can enable persistence or privilege escalation by granting elevated access to identities used for later actions. It relies on process creation telemetry, specifically the executable path and command-line arguments containing the required substrings.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Process Creating esxcli System Permission Set Admin for an Account
id: fa5400a4-1328-4835-8c7f-bf197f09e81f
status: test
description: This rule matches process executions of the esxcli binary on Linux where the command line includes the system context and performs a permission set action for an Admin role on an account. Assigning administrative permissions can enable persistence or privilege escalation by granting elevated access to identities used for later actions. It relies on process creation telemetry, specifically the executable path and command-line arguments containing the required substrings.
references:
- https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_esxcli_permission_change_admin.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-09-04
tags:
- attack.persistence
- attack.execution
- attack.privilege-escalation
- attack.t1059.012
- attack.t1098
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /esxcli
CommandLine|contains: system
CommandLine|contains|all:
- " permission "
- " set"
- Admin
condition: selection
falsepositives:
- Legitimate administration activities
level: high
license: DRL-1.1
related:
- id: 9691f58d-92c1-4416-8bf3-2edd753ec9cf
type: derived